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MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND,  CONTROL, 

COMMUNICATIONS,  AND  INTELLIGENCE) 

SUBJECT:  Audit  Report  on  DoD  Year  2000  Computing  Problem  Reports:  August  1997 
Report  (Report  No.  98-077) 


We  are  providing  this  audit  report  for  information  and  use.  This  report  is  the  first  of  a 
series,  the  primary  purpose  of  which  is  to  provide  the  DoD  Chief  Information  Officer  and 
other  senior  DoD  managers  with  an  independent  assessment  of  DoD  progress,  including 
identifying  areas  of  concern,  related  to  its  year  2000  efforts. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report.  Comments  on  the  draft  of  this  report  conformed  to  the  requirements  of  DoD  Directive 
7650.3  and  left  no  unresolved  issues.  Therefore,  no  additional  comments  are  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit  should 
be  directed  to  Ms.  Mary  Lu  Ugone,  Audit  Program  Director,  at  (703)  604-9049 
(DSN  664-9049);  Mr.  James  W.  Hutchinson,  Audit  Project  Manager,  at  (703)  604-9060 
(DSN  664-9060);  or  Mr.  Timothy  J.  Harris,  Audit  Team  Leader,  at  (703)  604-9053.  If 
management  requests,  we  will  provide  a  formal  briefing  on  the  audit  results.  See  Appendix  D 
for  the  report  distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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Report  No.  98-077  February  18,  1998 

(Project  No.  7RE-6023) 

Year  2000  Computing  Problem  Reports:  August  1997  Report 

Executive  Summary 


Introduction.  Information  technology  systems  have  typically  used  two  digits  to 
represent  the  year,  such  as  “97”  representing  1997,  to  conserve  electronic  data  storage 
and  reduce  operating  costs.  With  the  two-digit  format,  however,  the  year  2000  is 
indistinguishable  from  1900.  As  a  result  of  that  ambiguity,  computers  and  associated 
systems  and  application  programs  that  use  dates  to  calculate,  compare,  and  sort  could 
generate  incorrect  results  when  working  with  years  after  1999. 

This  is  one  of  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer,  DoD,  to 
monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 

Audit  Objectives.  The  overall  audit  objective  was  to  evaluate  the  DoD  year  2000 
oversight  actions  and  reports  submitted  to  the  Office  of  Management  and  Budget. 
Specifically,  we  determined  whether  the  DoD  quarterly  reports  to  the  Office  of 
Management  and  Budget  were  reasonable  and  accurate.  We  also  evaluated  the  internal 
reporting  requirements  and  process  used  by  DoD  to  monitor  and  oversee  the  DoD  year 
2000  efforts. 

Audit  Results.  The  DoD  Component  August  1997  reports  on  year  2000  did  not 
provide  all  the  required  information  and  were  not  fully  reliable.  Accordingly,  DoD 
does  not  yet  have  an  adequate  baseline  to  effectively  measure  its  year  2000  progress. 

The  audit  results  are  detailed  in  Part  I. 

Summary  of  Recommendatious.  We  recommend  an  update  to  the  DoD  Year  2000 
Management  Plan  that  reflects  changes  in  reporting  requirements  and  includes  adequate 
procedures  on  how  year  2000  quarterly  reports  should  reconcile. 

Mauagemeut  Commeuts.  The  Acting  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  concurred  with  the  recommendation  and 
stated  that  the  revised  DoD  Year  2000  Management  Plan,  which  is  planned  to  be  issued 
in  February  1998,  would  be  updated  as  recommended. 
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Part  I  -  Audit  Results 


Audit  Background 


The  year  2000  (Y2K)  problem  is  rooted  in  the  way  dates  are  recorded  and 
computed  in  information  technology  systems.  For  the  past  several  decades, 
computer  systems  have  t3^ically  used  two  digits  to  represent  the  year,  such 
as  “97”  representing  1997,  to  conserve  on  electronic  data  storage  and  reduce 
operating  costs.  With  the  two-digit  format,  however,  the  Y2K  is 
indistinguishable  from  1900.  As  a  result  of  the  ambiguity,  computers  and 
associated  system  and  application  programs  that  use  dates  to  calculate,  compare, 
or  sort  could  generate  incorrect  results  when  working  with  years  after  1999. 

DoD  Y2K  Management  Strategy.  In  his  role  as  the  DoD  Chief  Information 
Officer  (CIO),  the  Assistant  Secreta^  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  the  “DoD  Year  2000  Management 
Plan”  (the  Plan)  in  April  1997.  The  Plan  provides  the  overall  DoD  strategy  and 
guidance  for  inventorying,  prioritizing,  fixing,  or  retiring  systems,  and  for 
monitoring  progress.  According  to  the  Plan,  the  CIO  has  overall  responsibility 
for  overseeing  the  DoD  solution  to  the  Y2K  problem.  Each  DoD  Component  is 
responsible  for  awareness,  assessment,  renovation,  validation,  and 
implementation  action.  The  Plan  includes  a  description  of  the  five-phase  Y2K 
management  process  and  designates  the  Defense  Integration  Support  Tools 
database  as  the  official  repository  of  DoD  Component  information  technology 
systems  data. 

The  Five-Phase  Management  Process.  Each  of  the  five  phases  listed 
below  represents  a  major  Y2K  program  activity  or  segment.  Target  completion 
dates  range  from  December  1996  through  November  1,  1999. 

•  Phase  I  -  Awareness.  Organization  and  planning  take  place. 
Target  completion  date;  December  1996. 

•  Phase  II  -  Assessment.  Scope  of  Y2K  impact  is  identified  and 
system  level  analyses  take  place.  Target  completion  date:  June  1997. 

•  Phase  III  -  Renovation.  Required  system  fixes  are  accomplished. 
Target  completion  date:  December  1998. 

•  Phase  IV  -  Validation.  Systems  are  confirmed  as  Y2K  compliant 
through  assorted  testing  and  compliance  processes.  Target  completion  date: 
January  1999. 


•  Phase  V  -  Implementation.  Systems  are  fully  operational  after 
being  certified  as  Y2K  compliant.  Target  completion  date:  November  1, 1999. 

Defense  Integration  Support  Tools  Database.  Originally  designed  to 
support  the  planning  and  execution  of  the  DoD  automated  information  system 


migration  strategy,  the  Defense  Integration  Support  Tools  database  was  selected 
to  provide  DoD-wide  Y2K-related  information  that  DoD  managers  could  use  to 
track  and  monitor  the  transition  to  Y2K  compliance  of  mission-critical  and  other 
designated  systems.  The  Defense  Integration  Support  Tools  database, 
maintained  by  the  Defense  Information  Systems  Agency,  contains  data  on 
designated  DoD  Component  information  technology  systems.  The  information 
includes  hardware  platforms,  operating  systems,  applications  languages, 
communications,  and  interfaces. 

Y2K  Reporting  Requirements.  DoD  Components  are  required  to  submit  Y2K 
quarterly  reports  to  the  CIO  to  satisfy  both  DoD  and  Office  of  Management  and 
Budget  (0MB)  requirements. 

DoD  Reporting  Requirements.  On  March  12,  1997,  the  CIO  issued 
the  memorandum  “Year  2000  Refined  Reporting  Requirements  for  DoD,” 
which  established  minimum,  quarterly  reporting  requirements  for  Y2K 
assessment  and  progress  across  DoD.  The  purpose  of  the  reporting  requirement 
was  to  provide  the  CIO  of  DoD  and  CIOs  of  DoD  Components  with  the 
visibility  necessary  to  ensure  a  thorough  and  successful  transition  to  Y2K 
compliance  for  all  DoD  systems.  The  DoD  Components  are  required  to  report 
the  status  of  their  Y2K  efforts  to  the  CIO  of  DoD  each  quarter,  beginning 
April  18,  1997.  The  CIO  of  DoD  identified  23  DoD  Components  that  are 
required  to  report  on  the  status  of  systems  that  have  been  entered  into  the 
Defense  Integration  Support  Tools  Database.  The  information  reported  is 
intended  to  show  the  status  of  DoD  Y2K  efforts  and  is  being  used  by  the  CIO  of 
DoD  to  perform  oversight  for  DoD  Y2K  efforts  and  to  fulfill  0MB  reporting 
requirements  at  the  DoD  level. 

OMB  Reporting  Requirements.  On  May  7,  1997,  0MB  issued  the 
“Memorandum  on  Computer  Difficulties  Due  to  the  Year  2000  —  Progress 
Reports.  ”  The  purpose  of  the  memorandum  is  to  provide  Y2K  progress  reports 
to  Congress  and  the  public.  It  requires  heads  of  selected  Government  agencies 
to  report  on  the  status  of  Y2K  efforts  each  quarter,  with  the  initial  report  due 
May  15,  1997.  Each  agency  is  required  to  report  on  mission-critical  systems, 
including  information  on  the  number  of  systems  that  are  Y2K  compliant,  being 
replaced,  being  repaired,  and  being  retired.  As  of  July  3  1,  1997,  DoD  reported 
3,695  mission-critical  systems  to  OMB.  Of  those  systems,  652  were  already 
Y2K  compliant,  267  were  to  be  replaced,  2,593  were  being  repaired,  and  183 
were  to  be  retired.  The  total  cost  of  the  DoDY2K  effort  was  estimated 
at  $1.4  billion.  In  addition,  DoD  reported  that,  to  date,  no  DoD  Component 
has  reported  delayed  schedules  for  mission-critical  systems.  Appendix  C 
contains  the  supporting  data  of  the  August  1997  Y2K  report,  which  was 
submitted  to  OMB  on  August  15,  1997. 


‘The  23  DoD  Components  include  all  Defense  agencies  and  the  Services.  Some 
of  the  smaller  DoD  agencies  are  consolidated  into  1  of  the  23  DoD 
Components. 
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Audit  Objectives 


The  overall  audit  objective  was  to  evaluate  the  DoD  Y2K  oversight  actions  and 
reports  submitted  to  0MB.  Specifically,  we  determined  whether  the  DoD 
quarterly  reports  to  0MB  were  reasonable  and  accurate.  We  also  evaluated  the 
internal  reporting  requirements  and  process  used  by  DoD  to  monitor  and 
oversee  DoD  Y2K  efforts.  Because  of  the  urgency  of  reporting  the  audit  results 
to  senior  DoD  management,  we  did  not  formally  evaluate  related  management 
controls.  See  Appendix  A  for  a  discussion  of  the  scope  and  methodology  and 
Appendix  B  for  a  summary  of  prior  coverage. 
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System  Reporting 

The  DoD  Component  August  1997  Y2K  reports  did  not  provide  all  the 
required  information  and  were  not  fully  reliable.  The  reports  lacked 
required  and  reliable  information  because  DoD  did  not  establish  clear 
reporting  guidance  and  requirements.  Accordingly,  DoD  has  not 
established  an  adequate  baseline  to  effectively  measure  its  Y2K  progress. 


Y2K  Quarterly  Reporting 

DoD  Quarterly  Reports  to  OMB.  After  consolidating  DoD  Component  reports, 
the  CIO  submitted  the  first  two  DOD-level  reports  to  OMB  on  May  15  and 
August  15,  1997.  The  following  table  provides  a  comparison  of  the  total  number 
of  mission-critical  systems  reported  to  OMB. 


Reported  Status  of  DoD  Mission-Critical  Systems 


Total  mission-critical  systems 
Already  Y2K  compliant 
Being  replaced 
Being  repaired 
Being  retired 
Undetermined’ 


First  Quarter 
nVIav  19971 

Second  Quarter 
CAueust  19971 

3,962 

3,695 

00 

652 

473^ 

267 

2,752* 

2,593 

487* 

183 

141’ 

‘Changes  anticipated  as  assessments  are  completed. 

^Not  included  in  total.  Entries  may  have  been  reported  twice 
^Category  reported  only  for  First  Quarter 


The  DoD  Y2K  report  to  OMB  in  August  1997  showed  progress  toward  ensuring 
its  information  technology  systems  are  Y2K  compliant.  The  number  of 
compliant  systems  increased  by  70  from  May  to  August  1997.  However, 
conclusions  based  on  further  comparison  would  be  questionable  because  the 
information  used  to  compile  the  DoD  report  to  OMB  was  not  fully  complete  or 
reliable. 

Component  Quarterly  Reports.  Although  DoD  Component  reports  were  not 
fully  complete  or  reliable,  the  CIO  staff  stated  that  they  were  substantially  more 


5 


Year  2000  Information  Technology  System  Reporting 


complete  and  accurate  than  die  first  reports  because  the  DoD  Components  better 
understood  the  reporting  requirements.  However,  our  analyses  of  the  August 
1997  reports  did  not  confirm  that  statement. 

Completeness  of  Reports.  The  DoD  Component  reports  did  not 
substantially  improve  from  the  previous  quarter.  Our  analysis  showed  that  only 
one  DoD  Component  submitted  a  complete  report  for  May  1997.  Of  the  23 
DoD  Components  required  to  submit  an  August  1997  report,  initially,  14  were 
incomplete,  4  were  complete,  and  5  did  not  submit  a  report,  but  instead, 
requested  that  the  CIO  staff  extract  the  report  data  from  the  Defense  Integration 
Support  Tools  database.  The  14  incomplete  reports  were  missing  required  Y2K 
information  such  as: 

•  the  number  of  compliant  systems, 

•  the  number  of  noncompliant  systems  in  each  of  the  required  five 

phases,  and 


•  the  cost  to  repair  noncompliant  systems 

The  incomplete  reports  were  also  missing  infrastructure  devices  controlled  by 
information  technology,  such  as  personal  computers,  file  servers,  fax  machines, 
elevators,  and  access  security  systems. 

Reliability  of  Reports.  The  DoD  Component  Y2K  reports  for  August 
1997  were  unreliable.  Of  the  23  DoD  Components  required  to  submit  quarterly 
reports,  1 1  submitted  at  least  one  report  that  did  not  reconcile.  The  quarterly 
reports  did  not  reconcile  because  the  reporting  requirements  memorandum  that 
the  DoD  CIO  issued  did  not  provide  adequate  procedures  on  how  the  reports 
should  balance.  Further,  for  DoD  Components  that  submitted  a  report  that  did 
not  reconcile,  CIO  staff  needed  to  resolve  discrepancies  with  the  DoD 
Components  before  a  report  could  be  submitted  to  0MB.  The  reconciliation 
process  is  time-consuming  and  uses  resources  that  could  be  better  spent  on  CIO 
oversight  responsibilities  and  the  Y2K  effort.  We  believe  that  reporting 
guidance,  which  includes  sufficient  reconciliation  procedures,  is  needed  in  the 
DoD  Y2K  Management  Plan  to  reduce  the  amount  of  resources  being  expended 
to  reconcile  the  quarterly  reports. 

Procedures  and  Requirements  for  DoD  Component  Y2K  Reports. 

Reporting  procedures  and  requirements  for  Y2K  reports  need  to  be  improved  to 
increase  the  reliability  and  usefulness  of  the  information  being  collected. 


^For  a  second  quarter  report  to  reconcile,  the  number  of  noncompliant  systems 
minus  the  number  of  systems  that  are  being  retired  should  equal  the  number  of 
systems  that  are  placed  in  the  five  phases.  However,  the  reconciliation 
procedures  were  changed  for  third  quarter  reporting  in  that  the  number  of 
systems  being  replaced  will  also  be  subtracted  from  noncompliant  systems. 
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Procedures  for  Y2K  Reports.  Although  a  comparison  of  the  numbers 
provided  to  0MB  in  the  first  two  quarterly  reports  indicated  that  DoD  was 
progressing  in  identifying  and  fixing  systems  with  Y2K  problems,  such  a 
conclusion  may  be  misleading  because  the  procedures  used  for  determining  the 
numbers  reported  to  OMB  differed  substantially.  The  number  of  systems  and 
the  various  phases  they  were  in  were  changed  by  the  Components  in  response  to 
continuing  refinement  in  reporting  procedures.  For  example,  the  Navy  reported 
899  mission-critical  systems  for  May  1997  and  289  for  August  1997. 
Accordingly,  meaningful  comparisons  between  the  first  two  quarterly  reports 
submitted  to  OMB  were  difficult.  The  CIO  acknowledged  that  different 
reporting  methods  were  used  for  the  August  1997  quarterly  report  to  OMB,  and 
stated  that  the  report  will  provide  a  stable  baseline  against  which  future  reports 
can  be  meaningfully  compared.  However,  we  believe  that  the  reporting 
procedures  have  to  be  better  defined  in  the  DoD  Y2K  Management  Plan  (the 
Plan)  before  adequate  comparison  can  occur  between  the  reporting  periods. 

Reporting  Requirements  and  Definitions.  The  wide  disparity  in  the 
number  of  systems  that  the  DoD  Components  reported  (see  Appendix  C) 
indicates  that  the  DoD  Components  did  not  consistently  interpret  the  CIO 
reporting  requirements.  The  Plan  provides  definitions  for  “system”  and 
“mission-critical,  ”  but  the  definitions  are  nonspecific  and  open  to  interpretation. 
Because  DoD  Component  interpretations  of  those  definitions  were  not  uniform, 
the  usefulness  of  DoD  Component  reports  for  oversight  purposes  by  either  the 
DoD  CIO  or  OMB  was  questionable. 

Total  Systems  Reported.  A  Y2K  system  is  defined  in  the  Plan 
as: 


An  automated  process  that  uses  information  technology  such  as 
computer  hardware  and  software  to  perform  a  specific  function, 
application,  or  service. 

The  total  number  of  systems  reported  by  DoD  Components  varied  greatly.  For 
example,  the  Army  reported  13,687  systems  for  August  1997,  while  the  Navy  and 
the  Air  Force  reported  1,970  and  2,584  systems,  respectively.  It  is  reasonable  to 
conclude  that  the  Army  does  not  have  almost  seven  times  more  information 
technology  systems  than  the  Navy  or  five  times  more  systems  than  the  Air  Force. 
Conversely,  some  DoD  Components  reported  no  or  few  systems.  For  example, 
the  Armed  Forces  Information  Service  and  the  Defense  Contract  Audit  Agency 
reported  0  and  1  system,  respectively. 

Mission-Critical  Systems  Reported.  The  Plan  defines 
mission-critical  as: 

A  system  that  when  its  capabilities  are  degraded,  the  organization 
realizes  a  resulting  loss  of  a  core  capability. 

The  definition  of  mission-critical  is  important  because  OMB  requires  Y2K 
information  for  all  mission-critical  systems.  The  number  of  mission-critical 
systems  reported  varied  greatly.  In  the  August  1997  report,  DoD  reported  to 
OMB  3,695  mission-critical  systems.  One  DoD  Component,  the  National  Security 
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Agency,  reported  1,573  mission-critical  systems,  or  about  40  percent  of  the  total 
number  of  mission-critical  systems  that  DoD  reported.  In  comparison,  the  Army, 
the  Navy,  and  the  Air  Force  reported  367,  289,  and  395  systems  as  mission 
critieal,  respectively.  We  noted  that  six  DoD  Components  judged  100  percent  of 
their  systems  as  being  mission  critical,  while  three  DoD  Components  reported 
fewer  than  10  percent  of  their  systems  as  mission  critical.  Conclusively,  the  DoD 
Components  needed  clearer  definitions  of  reporting  terminology  to  reduce 
misinterpretations.  DoD  Components  may  have  submitted  incomplete  and 
unreliable  information  because  of  the  uncertainty  of  which  systems  to  report  and 
whether  to  report  them  as  mission  critical. 

Management  Action.  During  our  audit,  senior  DoD  officials  became  aware  that 
vague  definitions  negatively  affected  the  usefulness  and  accuracy  of  Y2K  reporting 
and  have  begun  to  take  corrective  action.  On  October  16,  1997,  the  DoD  Y2K 
Steering  Committee,  which  is  composed  of  senior  DoD  managers  and  is  chaired  by 
the  Deputy  Secretary  of  Defense,  assigned  the  responsibility  of  standardizing 
definitions  for  quarterly  reporting  to  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Commimications,  and  Intelligence). 

Initial  Data  for  Next  Reports.  According  to  CIO  staff,  initial  input  for  the 
next  round  of  reports  was  significantly  improved  over  the  August  1997  reports. 
Citing  only  one  incomplete  report,  CIO  staff  stated  that  the  DoD  Components 
submitted  improved  reports  because  reporting  guidance  and  direction  issued  by 
the  CIO  have  become  stable.  We  have  not  yet  evaluated  the  DoD  Component 
November  1997  quarterly  reports,  but  we  a^ee  that  positive  changes  were  inade 
to  the  reporting  process  and  specific  reporting  procedures.  The  next  report  in 
our  series  of  audit  reports  on  Y2K  issues  will  address,  if  appropriate,  further 
areas  of  concern  related  to  quarterly  Y2K  reporting. 


Summary 


Initial  problems  are  to  be  expected  in  establishing  any  new  reporting  process, 
especially  on  a  DoD-wide  basis.  Additionally,  both  OMB  and  DoD  established 
quarterly  reporting  requirements,  but  neither  organization  published  specific 
guidance  on  how  the  quarterly  reports  were  to  be  formulated.  Further,  DoD 
definitions  provided  for  Y2K  reporting  purposes  were  too  broad.  Accordingly, 
DoD  Component  reports  were  not  fully  complete  or  reliable.  More  important, 
reporting  consistency  was  insufficient  to  enable  useful  comparison  of  quarterly 
reports. 

Specific  reporting  guidance  and  requirements  have  evolved  since  the 
requirement  for  quarterly  reporting  was  established.  The  dissemination  of  that 
guidance  by  CIO  staff  was  informal;  that  is,  by  electronic  mail  and  telephone 
conversations.  Because  Y2K  quarterly  reporting  guidance  and  procedtures  have 
matured  and  stabilized,  they  need  to  be  formally  issued  to  DoD  organizations. 
We  agree  with  CIO  staff  that  the  best  mechanism  for  formal  distribution  is  a 
revised  DoD  Plan.  The  revised  Plan  should  set  forth  specific  procedures  for 
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DoD  Component  Y2K  reporting  and  include  clarified  definitions.  Until  Y2K 
quarterly  reports  become  stable  and  consistent,  the  reports  will  continue  to  be  of 
limited  value  for  oversight  purposes. 


Management  Comments  on  the  Finding  and  Audit  Response 

Management  Comments  on  Completeness  of  DoD  Component  Reports.  The 

Acting  Assistant  Secretary  of  Defense  (Command,  Control,  Communications, 
and  Intelligence)  provided  comments  on  the  draft  report  discussion  of  the 
completeness  of  DoD  Component  reports,  stating  that  the  second  quarterly 
reports  were  more  complete  than  the  first  quarterly  reports,  and  that  the 
reporting  of  embedded  chip  information  was  the  only  “incomplete”  category  of 
data  not  submitted  by  the  Components.  The  complete  text  of  management 
comments  is  in  Part  III  of  this  report. 

Audit  Response.  We  agree  with  the  Acting  Assistant  Secretary  that  the  second 
quarterly  reports  were  more  complete  than  the  first  quarterly  reports.  However, 
we  continue  to  believe  that  the  initial  submission  of  incomplete  reports  by  14  of 
23  DoD  Components  indicates  substantial  uncertainty  and  confusion  about  the 
Y2K  reporting  process,  procediues,  and  requirements.  We  do  not  agree  that 
embedded  chip  information  was  the  only  category  of  information  not  initially 
reported.  As  stated  in  the  draft  report,  other  categories  of  data  which  were 
initially  omitted  included  the  number  of  compliant  systems,  the  number  of 
noncompliant  systems  in  each  of  the  five  phases,  and  the  cost  to  repair 
noncompliant  systems. 

Management  Comments  on  the  Usefulness  of  Information  Collected. 

Regarding  the  utility  of  collecting  niombers  of  personal  computers  and 
communications  system  components,  the  Acting  Assistant  Secretary  recognized 
that  some  of  the  information  required  may  not  be  ideal  for  oversight  purposes, 
but  he  believes  that  the  collection  of  that  information  is  necessary  to  help  ensure 
that  all  DoD  information  technology  equipment  is  evaluated  for  Y2K 
compliance. 

Audit  Response.  In  the  draft  report,  we  concluded  that  some  data  that  the  CIO 
required  was  of  little  use  for  oversight  purposes.  Although  the  primary  concern 
of  0MB  personnel  was  mission-critical  systems,  they  also  required  a  brief 
narrative  summarizing  progress  made  in  other  infrastructure  systems  that  relied 
on  embedded  microchips,  such  as  elevators,  security  systems,  and  biomedical 
devices.  Within  the  infrastructure  reporting  category,  the  CIO  also  requires  the 
DoD  Components  to  report  personal  computers,  file  servers,  and 
communications  hardware  and  software  modules.  We  questioned  the  need  for 
that  additional  reporting  requirement  as  the  information  did  not  provide  a  gauge 
for  monitoring  progress  because  the  total  number  of  DoD  personal  computers 
and  network  components  had  not  been  defined.  Additionally,  because  the  DoD 
definition  of  “system”  is  broad  and  open  to  interpretation,  DoD  had  no 
assurance  that  the  personal  computers  and  networks  reported  in  the 
“infrastructure”  category  were  not  also  reported  as  part  of  other  information 
technology  systems. 
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We  continue  to  question  whether  watching  aggregate  nraibers  grow  provides 
valuable  oversight  information.  However,  upon  reconsideration,  we  agree  that 
oversight  options  for  ensuring  that  all  of  the  information  technology  resources 
for  DoD  are  limited  and  that  some  degree  of  oversight  is  better  than  none. 
Additionally,  on  January  20,  1998,  0MB  issued  new  quarterly  reporting 
requirements  which  now  specifically  require  telecommunications  systems  to  be 
reported  in  the  “infrastructure”  category.  Further,  on  Februap^  4,  1998,  the 
Acting  Assistant  Secretary’s  staff  orally  committed  to  include  in  the  revised 
DoD  Plan  specific  cautions  to  the  DoD  Components  about  possible  “double 
counting”  in  their  quarterly  Y2K  reports.  Based  on  those  factors,  the  issue  was 
omitted  from  our  final  report. 


Recommendations  for  Corrective  Action  and  Management 
Comments 


Deleted  Recommendation.  As  a  result  of  management  comments,  we  deleted 
draft  Recommendation  2.  Draft  Recommendation  1.  is  now  unnumbered. 

We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence),  in  the  role  of  the  DoD  Chief 
Information  Officer,  update  the  DoD  Year  2000  Management  Plan  to 
reflect  changes  in  reporting  requirements  and  to  include  adequate 
procedures  on  how  year  2000  quarterly  reports  should  reconcile. 

Management  Comments.  The  Assistant  Secretary  concurred  and  stated  that 
the  DoD  Y2K  Management  Plan  would  be  updated  accordingly.  The  Assistant 
Secretary  anticipates  issuance  of  the  updated  Management  Plan  in  Febmary 
1998.  The  complete  text  of  management  comments  is  in  Part  III  of  this  report. 
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Scope  and  Methodology 

Work  Performed.  We  reviewed  the  reports  that  DoD  Components  submitted 
to  the  CIO  for  the  first  and  second  reporting  quarters,  ending  April  30  and 
July  3  1,  1997,  respectively.  We  evaluated  the  completeness  and  reliability  of 
the  reports  in  accordance  with  CIO  reporting  requirements  and  the  requirements 
stated  in  the  DoD  Y2K  Management  Plan.  We  also  evaluated  the  usefulness  of 
the  report  information  for  oversight  purposes.  We  interviewed  personnel  within 
the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  ^d 
Intelligence)  who  are  responsible  for  issuing  reporting  guidance  and  collecting 
the  Y2K  information  from  the  DoD  Components  and  submitting  the  information 
to  0MB.  We  also  interviewed  personnel  within  the  DoD  Components  who  are 
responsible  for  the  Y2K  reporting.  The  scope  of  the  audit  was  limited  in  that 
we  did  not  review  the  management  control  program  because  DoD  has 
acknowledged  the  Y2K  computing  problem  as  an  area  with  material 
management  control  weaknesses  and  further  reporting  on  those  weaknesses 
would  be  redundant. 

This  is  one  of  a  series  of  reports  being  issued  by  the  Inspector,  General,  DoD, 
in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a 
listing  of  audit  projects  addressing  this  issue,  see  the  Y2K  webpage  on  IGNET 
(at  http://www.ignet.gov/  ). 

Use  of  Computer-Processed  Data  and  Statistical  Sampling.  We  did  not  use 
computer-processed  data  or  statistical  sampling  procedures  for  this  audit. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  from  July  through  October  1997  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 
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General  Accounting  Office 


The  General  Accounting  Office  has  conducted  several  audits  related  to  Y2K 
issues.  The  audits  are  summarized  below. 

General  Accounting  Office  Report  No.  AIMD-98-35  (OSD  Case  No.  1484), 
“Defense  Computers:  Air  Force  Needs  to  Strengthen  Year  2000 
Oversight,”  January  16,  1998.  Congress  requested  the  review  of  the 
Air  Force  Y2K  program.  The  review  focused  on  Air  Force  oversight  of  its 
Y2K  program  and  the  appropriateness  of  its  strategy  and  actions  for  ensuring 
that  the  Air  Force  will  successfully  address  the  Y2K  problem.  The  Air  Force 
has  taken  a  number  of  positive  actions  toward  fulfilling  its  Y2K  oversight 
responsibilities.  At  the  same  time,  the  Air  Force  had  not  yet  adequately 
addressed  several  critical  issues  that  would  ensure  that  it  is  well-positioned  to 
deal  with  the  later,  and  more  difficult,  phases  of  Y2K  correction.  The  review 
showed  that  some  Air  Force  components  are  not  adequately  planning  for  the 
testing  phase  of  their  Y2K  effort  and  developing  contingency  plans.  Some  Air 
Force  components  are  also  taking  conflicting  approaches  toward  determmmg  the 
actual  impact  of  the  program  status  to  their  system  interfaces.  If  the  Air  Force 
does  not  promptly  address  and  take  consistent  action  on  those  issues,  it  may 
well  negate  any  success  it  may  have  in  making  its  systems  Y2K  compliant. 

While  the  Air  Force  has  enlisted  the  help  of  the  Air  Force  Audit  Agency  to 
address  some  of  those  concerns,  the  Air  Force  must  continue  its  comprehensive 
oversight  to  ensure  that  it  can  address  unforeseen  problems  and  delays  in  the 
next,  more  difficult  phase. 

General  Accounting  Office  Correspondence  Report  No.  AIMD-98-7R  (OSD 
Case  No.  1471),  “Defense  Computers:  Technical  Support  Is  Key  to  Naval 
Supply  Year  2000  Success,”  October  21,  1997.  The  report  states  that  Naval 
Supply  Systems  Command  had  not  allocated  sufficient  resources  to  the  Fleet 
Material  Support  Office  Year  2000  Project  Office  to  ensure  that  all  systems 
interfaces  were  identified  and  adequately  monitored  for  progress.  Also,  Naval 
Supply  Systems  Command  had  not  directed  that  risk  assessments  be  performed 
or  that  contingency  plans  be  prepared  at  the  system  and  functional  levels.  As  a 
result  of  the  concerns  that  the  General  Accounting  Office  raised,  Naval  Supply 
Systems  Command  and  Fleet  Material  Support  Office  officials  have  begun 
addressing  system  interface  issues  by  assigning  full-time  staff  to  identify  date- 
related  data  elements  in  interface  files  and  to  ensure  that  date  formats  are 
compatible.  The  actions,  together  with  Naval  Supply  Systems  Command’s 
plans  for  requiring  systems  managers  to  perform  risk  assessments  and  develop 
contingency  plans  for  critical  systems,  should  help  mitigate  the  loss  of 
operational  capability  at  the  year  2000.  As  Naval  Supply  Systems  Command 
progresses  to  the  renovation,  validation  (testing),  and  implementation  phases  of 
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the  Y2K  program,  it  must  pay  continued  attention  to  those  issues  to  better 
ensure  that  the  year  2000  challenge  is  met.  The  Director,  Test,  Systems 
Engineering  and  Evaluation,  concurred  with  a  draft  of  this  report. 

General  Accounting  Office  Report  No.  AIMD-97-149  (OSD  Case  No.  1446), 
“Defense  Computers:  Logistics  Systems  Support  Center  Needs  to  Confront 
Significant  Year  2000  Issues,”  September  26,  1997.  The  report  states  that 
while  Y2K  improvement  efforts  have  been  initiated  by  the  Logistics  Systems 
Support  Center  on  its  Commodity  Command  Standard  System  program,  the 
Logistics  Systems  Support  Center  has  not  completed  several  key  project 
management  actions  associated  with  the  assessment  phase.  As  a  result,  the 
Logistics  Systems  Support  Center  is  not  presently  well-positioned  to  move  to  the 
more  difficult  phases  of  renovation,  validation,  and  implementation  in  the  Y2K 
process  phases  that  industry  experts  estimate  could  consume  as  much  as  three- 
fourths  of  Y2K  project  time  and  resources.  The  report  recommends  that  the 
Logistics  Systems  Support  Center  still  needs  to  take  a  number  of  actions  to 
increase  its  chances  of  success,  including  managing  competing  workload 
priorities,  planning  for  testing,  clarifying  and  coordinating  written  systems 
interface  agreements,  and  developing  a  contingency  plan.  To  increase  its 
chances  of  successfully  managing  its  Y2K  program,  the  Logistics  Systems 
Support  Center  will  also  need  to  institutionalize  a  repeatable  software  change 
process  that  can  be  used  from  project  to  project.  Given  the  prominence  of  date 
processing  in  the  Commodity  Command  Standard  System  and  its  central  mission 
of  sustaining  the  solider  in  the  field,  the  Logistics  Systems  Support  Center 
cannot  delay  any  longer,  and  must  demonstrate  that  it  will  perform  all  the  key 
actions  associated  with  sound  Y2K  planning  and  management.  The  Director, 
Test,  Systems  Engineering  and  Evaluation,  concurred  with  a  draft  of  the  report. 

General  Accounting  Office  Correspondence  Report  No.  AIMD-97-120R 
(OSD  Case  No.  1399),  “Defense  Computers:  Standard  Systems  Group 
Needs  to  Sustain  Year  2000  Progress,”  August  19,  1997.  The  report  states 
that  the  Standard  Systems  Group  must  further  emphasize  management  and 
oversight  of  systems  interfaces  to  ensure  successful  implementation  of  Y2K- 
compliant  systems  throughout  its  user  community.  Also,  a  number  of  Standard 
Systems  Group  systems  must  use  standard  interface  message  formats  to 
exchange  data  that  are  defined  by  external  entities  outside  the  control  of  the 
Standard  Systems  Group.  Some  of  the  message  formats  had  not  been  finalized 
by  the  organizations  responsible  for  their  definition.  Recently,  officials  from 
the  Standard  Systems  Group’s  Year  2000  Project  Office  began  addressing  the 
interface  issue.  If  effectively  implemented  by  the  project  office,  the  effort 
should  be  a  positive  step  toward  preventing  loss  of  operational  capabilities 
between  the  Standard  Systems  Group’s  internal  and  external  systems’  interface 
message  formats  at  the  year  2000.  The  Air  Force  Director,  Communications 
and  Information,  concurred  with  a  draft  of  the  report. 

General  Accounting  Office  Report  No.  AIMD-97-112  (OSD  Case  No.  1395), 
“Defense  Computers:  Improvements  to  DoD  Systems  Inventory  Needed  for 
Year  2000  Effort,”  August  13,  1997.  The  report  states  that  while 
improvement  efforts  have  been  initiated,  the  Defense  Integration  Support  Tools 
database  will  not  be  usable  and  reliable  in  time  to  have  a  beneficial  inapact  on 
Y2K  correction  efforts.  The  Defense  Integration  Support  Tools  contains  the 
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DoD-wide  inventory  of  automated  information  systems.  The  report 
recommended  investigation  of  all  duplicate,  inactive,  and  incomplete  entries; 
expedited  development  and  implementation  of  the  purging  inethodology;  and 
expansion  of  information  contained  in  the  database  for  individual  systems  to 
include  key  program  activity  schedules  that  managers  of  interfacing  systems 
need  to  ensure  that  their  systems’  interfaces  are  maintained  during  the 
renovation  phase.  The  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  concurred  with  the  recommendations  and 
stated  that  DoD  plans  to  take  corrective  action  by  performing  statistical 
sampling  of  the  Defense  Integration  Support  Tools  database  to  validate 
accuracy. 

General  Accounting  Office  Report  No.  AIMD-97-106  (OSD  Case  No.  1389), 
“Defense  Computers;  Issues  Confronting  Defense  Logistics  Agency  in 
Addressing  Year  2000  Problems,”  August  12,  1997.  The  report  states  that 
the  Defense  Logistics  Agency  had  already  assessed  the  Y2K  impact  oii  its 
operations;  inventoried  its  systems;  conducted  pilot  projects  to  detennine  Y2K 
effects  on  some  of  its  major  systems;  and  developed  and  issued  policies, 
guidelines,  standards,  and  recommendations  on  Y2K  correction  for  the  agency. 
The  Defense  Logistics  Agency  had  not  prioritized  the  86  automated  information 
systems  that  it  plans  to  have  operational  in  the  year  2000  to  ensure  Aat  mission- 
critical  systems  are  corrected  first.  In  addition,  the  Defense  Logistics  Agency 
had  not  developed  contingency  plans  in  the  event  that  any  of  the  systems  caimot 
be  corrected  on  time.  The  report  recommended  that  the  Defense  Logistics 
Agency  complete  signed,  written  interface  agreements  detailing  data  ephange 
methods;  develop  a  Y2K  systems  prioritization  plan;  and  prepare  contingency 
plans  for  all  critical  systems.  The  Under  Secretary  of  Defense  for  Acquisition 
and  Technology  concurred  with  the  recommendation  on  interface  agreements 
and  contingency  plans  but  did  not  concur  with  the  recommendation  on  systems 
prioritization,  stating  that  the  Defense  Logistics  Agency  planning  efforts  and 
strategy  for  renovating  its  systems  are  adequate.  The  Defense  Logistics  Agency 
is  in  the  process  of  ensuring  that  documented  agreements  are  prepared  for  all 
interfaces  requiring  changes  between  their  interface  partners.  Completion  was 
expected  in  September  1997.  The  Defense  Logistics  Agency  is  also  in  the 
process  of  preparing  contingency  plans  within  each  business  area  focusing  on 
those  systems  that  Y2K  will  affect.  Initial  plans  were  to  be  prepared  by  October 
1997. 

General  Accounting  Office  Report  No.  AIMD-97-117  (OSD  Case  No.  1392), 
“Defense  Computers;  Defense  Finance  and  Accounting  Service  Faces 
Challenges  in  Solving  the  Y2K  Problems,”  August  11,  1997.  The  report 
states  that  the  Defense  Finance  and  Accounting  Service  had  developed  a  Y2K 
strategy  consistent  with  the  DoDY2K  Management  Plan  and  has  defined 
conditions  that  automated  information  systems  must  meet  to  obtain  certification 
as  Y2K  compliant.  However,  the  Defense  Finance  and  Accounting  Service  had 
not  identified  all  critical  tasks  for  achieving  Y2K  objectives,  established 
milestones  for  completing  all  tasks,  performed  formal  risk  assessments  of  all 
systems  to  be  renovated,  or  prepared  contingency  plans  in  the  event  that 
renovations  are  not  completed  in  time  or  fail  to  operate  properly.  The  report 
also  states  that  the  Defense  Finance  and  Accounting  Service  had  not  identified 
all  system  interfaces  and  had  completed  only  230  of  904  written  agreements 
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with  interface  partners.  Further,  the  Defense  Finance  and  Accounting  Service 
had  not  adequately  ensured  that  testing  resources  will  be  available  to  determine 
whether  all  operational  systems  are  compliant  before  the  year  2000.  The  report 
recommended  that  the  Defense  Finance  and  Accounting  Service  identify  Y2K 
program  actions  and  milestones,  issue  guidance  to  ensure  continuity  of 
operations,  identify  external  interfaces  and  obtain  written  agreements  describing 
the  method  of  data  exchange,  and  devise  a  testing  schedule  to  ensure  that  all 
systems  can  operate  in  a  Y2K  environment.  The  Under  Secretary  of  Defense 
(Comptroller)  concurred  with  the  recommendations.  The  Defense  Finance  and 
Accounting  Service  agreed  to  update  its  existing  Year  2000  Executive  Plan  and 
its  Corporate  Contingency  Plan.  It  also  agreed  to  have  all  written  interface 
agreements  with  interface  partners  in  place  by  September  30,  1997,  and  to  fully 
implement  its  certification  process  for  ensuring  diat  all  systems  are  Y2K 
compliant.  Further,  the  Defense  Finance  and  Accounting  Service  agreed  to 
devise  a  testing  schedule  that  identifies  the  test  facilities  and  resources  needed 
for  performing  proper  testing  of  its  systems  in  a  Y2K  environment. 

General  Accounting  Office  Publications.  Among  the  publications  that  the 
General  Accounting  Office  issued  relating  to  the  Y2K  problem  are  the  Exposure 
Draft  (GAO/AIMD-10.  1.14),  “Year  2000  Computing  Crisis:  An  Assessment 
Guide,”  February  1997;  and  the  Exposure  Draft  (GAO/ AIMD-10. 1.17), 

“Year  2000  Computing  Crisis:  Audit  Program  Guide,”  June  1997.  The 
assessment  guide  provides  a  framework  and  a  checklist  for  assessing  the 
readiness  of  Federal  agencies  to  achieve  Y2K  compliance.  The  assessment 
guide  provides  information  on  the  scope  of  the  challenge  and  offers  a  structured 
approach  for  reviewing  the  adequacy  of  agency  planning  and  management  of  the 
Y2K  program.  The  audit  program  guide  provides  information  tecMology 
system  auditors  with  more  detailed  guidelines  to  use  in  reviewing  individual 
agency  efforts  in  solving  Y2K  issues. 


Inspector  General,  DoD 


Inspector  General,  DoD,  Report  No.  98-065,  “DoD  Information  Technology 
Solicitations  and  Contract  Compliance  for  Year  2000  Requirements,” 
February  6,  1998.  The  review  focuses  on  the  compliance  of  DoD  information 
technology  solicitations  and  contracts  with  Federal  Acquisition  Regulation 
section  39.106,  “Y2K  Compliance.  ”  The  report  states  that  20  of  the  reviewed 
35  indefinite-delivery/indefinite-quantity  and  indefinite-delivery-requirement 
information  technology  contracts  (for  commercial  off-the-shelf  products)  did  not 
have  the  required  Federal  Acquisition  Regulation  Y2K  compliance  language, 
and  none  of  the  35  contracts  required  testing  of  purchased  products.  As  a 
result,  DoD  has  no  assurance  that  information  technology  products  purchased 
were  Y2K  compliant.  Further,  the  purchase  of  noncompliant  products  may 
seriously  hamper  the  ability  of  DoD  to  perform  its  administrative  and 
warfighting  mission  requirements.  Additionally,  because  33  of  the  35  contracts 
are  available  for  use  by  other  Federal  agencies,  nonconforming  contract  items 
could  negatively  affect  the  ability  of  the  Federal  Government  to  survive  the 
Y2K  crisis.  After  the  audit  results  briefing,  the  Aeting  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  and  the 
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Director,  Defense  Procurement,  drafted  new  guidance  for  the  DoD  Components 
that  would  require  Y2K-compliant  information  technology  and  testing  of  items 
purchased  from  the  information  technology  contracts.  The  guidance  was  later 
signed  by  the  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence).  In  addition.  Army,  Navy,  and  Air  Force 
contracting  officers  completed  the  contract  modifications  to  include  the  required 
Federal  Acquisition  Regulation  Y2K  language  in  17  additional  contracts.  Three 
other  Air  Force  contracts  are  being  reviewed. 

Inspector  General,  DoD,  Report  No.  98-074,  “Sharing  Year  2000  Testing 
Information  on  DoD  Information  Technology  Systems,”  February  12,  1998. 

The  review  focused  on  whether  planning  for  year  2000  testing  is  adequate  to 
ensure  that  mission  critical  DoD  information  technology  systems  will  continue 
to  operate  properly  after  the  year  2000.  While  DoD  has  designated  the  use  of 
Internet  homepages  as  the  primary  means  of  sharing  year  2000  related 
information  and  DoD  Components  have  made  progress  in  establishing  year  2000 
information  on  their  respective  homepages,  the  process  for  sharing  year  2000 
testing  information  can  be  more  effective.  The  report  states  that  DoD 
Components  may  be  expending  time-sensitive  resources  inefficiently  in  solving 
the  year  2000  problem  through  the  duplication  of  efforts  and  in  attempting  to 
locate  accurate  testing  information.  Further,  the  ability  to  retrieve  and  use  all 
appropriate  testing  information  in  a  timely  and  efficient  maimer  will  be 
instrumental  in  the  solution  of  the  year  2000  problem.  The  report 
acknowledged  actions  taken  by  the  Assistant  Secretaty  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  to  establish  a  DOD-sponsored  year 
2000  testing  information  center  for  collecting,  analyzing,  and  disseminating  year 
2000  related  testing  information,  and  initial  efforts  to  provide  a  year  2000 
hotline  service  to  the  DoD  Components.  The  report  recommended  that 
additional  aetion  be  taken  to  notify  DoD  Components  of  the  testing  center’s  year 
2000  role  and  responsibilities  and  of  the  DoD  Components’  responsibility  to 
share  testing  information.  The  report  also  recommended  that  DoD  internet 
homepages  be  organized  to  enable  users  to  quiekly  and  easily  access  the  center 
for  year  2000  testing  information. 
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Appendix  C.  DoD  Component  August  1997 
Reports 


DoD  Component 


Mission-  Five-Phase  Management  Process 

Total  Critical  Assess-  Reno-  Vali-  Imple- 

Svstems  Systems _ ment  vation  dation  mentation 


Army 

13,687 

367 

152 

44 

16 

16 

Navy 

1,970 

289 

68 

54 

5 

28 

Air  Force 

2,584 

395 

174 

65 

31 

4 

Joint  Staff 

302 

169 

17 

59 

37 

1 

Ballistic  Missile 

Defense  Organization 

75 

37 

16 

1 

1 

0 

Defense  Contract  Audit  Agency 

1 

1 

0 

0 

0 

0 

Defense  Commissaiy  Agency 

36 

7 

1 

2 

1 

3 

Defense  Finance  and 

Accounting  Service 

186 

91 

24 

45 

2 

0 

Defense  Intelligence  Agency 

109 

109 

90 

6 

13 

0 

DoD  Intelligence  Information 
System* 

109 

109 

46 

26 

25 

0 

Defense  Investigative  Service 

7 

0 

0 

0 

0 

0 

Defense  Information  Systems 
Agency 

339 

106 

0 

56 

1 

5 

Defense  Logistics  Agency 

333 

14 

0 

6 

6 

0 

Defense  Security  Assistance 

Agency 

11 

4 

0 

3 

0 

1 

Defense  Special  Weapons  Agency 

115 

10 

1 

0 

0 

2 

National  Imagery  and  Mapping 
Agency 

222 

175 

19 

40 

0 

0 

National  Reconnaissance  Agency 

27 

27 

24 

3 

0 

0 

National  Security  Agency 

1,573 

1,573 

1,070 

320 

53 

53 

Office  of  the  Assistant  Secretary 
of  Defense  (Health  Affairs) 

112 

112 

27 

15 

6 

24 

Armed  Forces  Information 

Services 

0 

0 

0 

0 

0 

0 

On-Site  Inspection  Agency 

41 

0 

0 

0 

0 

0 

Under  Secretary  of  Defense  for 
Acquisition  and  Technology 

75 

0 

0 

0 

0 

0 

Washington  Headquarters  Services 

1  3  6 

100 

8 

12 

27 

_5 

Total 

22,050 

3,695 

1,737 

757 

224 

142 

♦Portion  centrally  funded  for  the  Armed  Services. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform) 

Deputy  Under  Secretary  of  Defense  (Logistics) 

Director,  Defense  Procurement 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Under  Secretary  of  Defense  for  Personnel  and  Readiness 

Assistant  Secretary  of  Defense  (Command,  Control,  Commimications,  and  Intelligence) 
Assistant  Secretary  of  Defense  (Health  Affairs) 

Assistant  Secretary  of  Defense  (Public  Affairs) 


Joint  Chiefs  of  Staff 

Director,  Joint  Staff 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 
Chief  Information  Officer,  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 
Chief  Information  Officer,  Navy 

Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General.  Department  of  the  Air  Force 
Chief  Information  Officer,  Air  Force 

Unified  Commands 

Commander  in  Chief,  U.  S  European  Command 
Commander  in  Chief,  U.S  Pacific  Command 
Commander  in  Chief,  U.S.  Atlantic  Command 
Commander  in  Chief,  U.S.  Southern  Command 
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Unified  Commands  (Cont’d) 

Commander  in  Chief,  U.S.  Central  Command 
Commander  in  Chief,  U.S.  Space  Command 
Commander  in  Chief,  U.S.  Special  Operations  Command 
Commander  in  Chief,  U.S.  Transportation  Command 
Commander  in  Chief,  U.S.  Strategic  Command 

Other  Defense  Organizations 

Director,  Ballistic  Missile  Defense  Organization 

Chief  Information  Officer,  Ballistic  Missile  Defense  Organization 
Director,  Defense  Advanced  Research  Projects  Agency 

Chief  Information  Officer,  Defense  Advanced  Research  Projects  Agency 
Director,  Defense  Commissary  Agency 

Chief  Information  Officer,  Defense  Commissary  Agency 
Director,  Defense  Contract  Audit  Agency 

Chief  Information  Officer,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accoimting  Service 

Chief  Information  Officer,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency. 

Chief  Information  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Legal  Services  Agency 

Chief  Information  Officer,  Defense  Legal  Services  Agency 
Director,  Defense  Logistics  Agency 

Chief  Information  Officer,  Defense  Logistics  Agency 
Director,  Defense  Security  Assistance  Agency 

Chief  Information  Officer,  Defense  Security  Assistance  Agency 
Director,  Defense  Security  Service 

Chief  Information  Officer,  Defense  Security  Service 
Director,  Defense  Special  Weapons  Agency 

Chief  Information  Officer,  Defense  Special  Weapons  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Director,  On-Site  Inspection  Agency 

Chief  Information  Officer,  On-Site  Inspection  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 

Non-Defense  Federal  Organizations  and  Individuals 

Chief  Information  Officer,  General  Services  Administration 
Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 

Technical  Information  Center,  National  Security  and  International  Affairs  Division,  General 
Accounting  Office 
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Non-Defense  Federal  Organizations  and  Individuals  (Cont’d) 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and  Information 
Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional  committees  and 
subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subconunittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Part  III  -  Management  Comments 


Office  of  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and 
Intelligence)  Comments 


ASSISTANT  SECRETARY  OF  DEFENSE 
6000  DEFENSE  PENTAGON 
WASHINGTON.  DC  203016000 

January  15,  1998 


COHMANO,  CONTROL. 
COMMONICATtONS.  AMD 
INTCLUGENCC 


MEMORANDUM  FOR  DIRECTOR,  ACQUISITION  MANAGEMENT  DIRECTORATE, 
OFFICE  OF  THE  INSPECTOR  GENERAL,  DOD 

SUBJECT:  Response  to  the  Office  of  the  Inspector  General  (OIG)  , 

DoD  Draft  Audit  Report  on  Year  2000  Information 
Technology  System  Reporting  Requirements , 

Project  No.  7RE-6023,  dated  November  26,  1997 


Thcuik  you  for  the  opportunity  to  review  and  comment  on  your 
November  26,  1997,  draft  audit  report  on  reporting  requirements 

for  Year  2000  {Y2K)  information  technology  systems.  We  have 
reviewed  the  report  and  agree  that  an  update  of  the  Department 
of  Defense  (DoD)  Year  2000  Management  Plan  is  needed.  The 
report  recommended,  in  addition,  that  the  DoD  Components  be 
required  only  to  report  necessary  and  useful  oversight 
information.  Attached  are  my  comments  on  the  report’s 
recommendations  along  with  some  specific  comments  that  respond 
to  several  of  the  report’s  findings. 

We  appreciate  the  opportunity  to  work  with  the  OIG  audit 
team  and  to  exchange  information  on  the  Y2K  project.  The  audit 
is  helpful  for  ensuring  that  the  DoD  maintains  a  reliable 
reporting  mechanism  that  will  satisfy  the  requirements  of  both 
the  Department  and  the  oversight  agencies  to  whom  we  report  our 
progress.  Also,  the  audit  has  highlighted  areas  where  the 
Department  may  improve  the  information  collection  process . 

Please  incorporate  this  memorandum,  along  with  the  attachment, 
in  the  final  audit  report. 


Attachment 


o 
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to  th«  Office  of  the  Inspector  General  (DIG) 

DOD  Draft  Audit  Report  on 

•Year  2000  Information  Teclmology  System  Reporting  Reguireaents'' 
Project  No.  7RE-S023,  dated  November  26,  1997 

Reco^^TTigandation  1;  The  DoDIG  recommended  an  update  to  the  DoD 
Year  2000  Management  Plan  reflecting  changes  in  reporting 
requirements  and  including  adequate  procedures  on  how  year  2000 
quarterly  reports  should  reconcile. 

Responses  Concur.  Procedures  for  reporting  progress  each 
quarter  in  evaluating  and  repairing  automated  information 
systems  (AISs)  and  devices  controlled  by  information  technology 
have  been  widely  disseminated  through  meetings  and  electronic 
media.  However,  the  Department  agrees  that  revising  the  DoD 
Year  2000  Management  Plan  would  codify  these  informal 
instructions  into  a  single  document. 

The  DoD  Components  have  been  participating  with  the  DoD 
Chief  Information  officer's  staff  in  revising  the  Plan  since 
August  1997.  Section  9.  "DoD  System  Inventory  and  Quarterly 
Reporting  Requirements,"  provides  thorough  instruction  on 
providing  progress  status  in  addressing  the  Year  2000  (Y2K) 
problem,  including  directions  on  balancing  the  numbers  that  are 
reported.  Balanced  data  insures  reliability  of  the  information 
DoD  provides  to  Congress  and  others.  The  Department  has  delayed 
the  publishing  of  the  second  edition  of  the  Management  Plan  in 
order  to  include  revised  requirements  under  development  by  the 
Office  of  Management  and  Budget  (0MB) .  The  revised  Plan  is 
projected  for  publication  in  February  1998. 

Recoimnendation  2;  The  OIG  recommended  that  the  reporting 
requirements  be  revised  for  DoD  Components  to  ensure  that  only 
necessary  and  useful  oversight  information  is  reported. 

Response:  Non-concur.  The  Department  understands  that  the 
Components  may  find  the  currently  required  reporting  onerous. 
However,  it  has  not  been  the  intent  of  the  Department  to  levy 
reporting  that  is  not  needed.  Most  reporting  requirements  come 
from  Congress  and  0MB.  Their  interest  and  new  requirements  will 
increase . 

The  information  we  are  currently  collecting  will  continue 
to  be  required,  along  with  additional  information.  For  example, 
the  Office  of  Management  and  Budget  (0MB)  published  their  third 
report  "Progress  on  Year  2000  Conversion*  in  December  1997. 


Final  Report 
Reference 


Unnumbered 


Deleted 
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Final  Report 
Reference 


Deleted 


Page  5 


That  report  accelerates  target  dates  for  completing  renovation 
to  September  1998  and  implementation  to  March  1999.  Systems 
that  cannot  meet  this  schedule  must  be  reported  in  upcoming 
quarterly  reports.  0MB  is  requiring  independent  verification  of 
progress  and  has  tasked  the  CIO  Council  to  develop  government- 
wide  best  practices  in  contingency  planning.  Data  exchanges 
with  States  must  be  inventoried  by  February  1,  1998,  and  Federal 
agencies  must  communicate  the  precise  format  of  the  data 
exchanges  and  the  timing  of  the  change  to  the  new  format  by 
March  1,  1998. 

None  of  the  pre-existing  0MB  requirements  have  been 
rescinded.  0MB  has  in  preparation  at  this  time,  a  draft  letter 
which  includes  a  requirement  to  provide  more  thorough 
information  on  efforts  to  fix  non-mission  critical  system,  data 
exchange  information,  the  status  of  validation  and  contingency 
planning  efforts,  more  extensive  embedded  chip  data,  and 
progress  status  in  fixing  other  government-wide  systems.  Much 
of  this  information  we  are  not  yet  collecting. 

Therefore,  we  find  the  OIG  recommendation  to  minimize ^ 
reporting  requirements  unattainable.  External  Y2K  "reporting 
requirements"  will  increase. 

Additional  Coanmentfl: 

Page  5,  Year  2000  Information  Technology  System  Reporting 
Requirements,  last  sentence:  "Additionally,  the  Chief 

Information  Officer  for  DoD  collects  information  not  required  by 
the  Office  of  Management  and  Budget  and  which  is  of  limited  use 
for  oversight  purposes." 

There  was  no  information  collected  from  the  Components 
for  the  third  Quarterly  Report  to  0MB  that  was  not  used  in  the 
report.  The  only  questionable  information  may  stem  from  a  data 
item  on  interfaces  outlined  on  the  reporting  spreadsheets.  The 
Components  were  instructed  to  disregard  the  interface  issues 
until  my  office  provided  improved  guidance.  None  of  the 
Components  reported  interface  data. 

Page  6,  Component  Quarterly  Reports,  sentences  2  and  3:  "The 

CIO  staff  believed  that  the  reports  for  the  second  quarter  were 
substantially  more  complete  and  accurate  because  the  Dod 

Components  better  understood  the  reporting  requirements . 

However,  our  cuialyses  of  the  reports  for  the  second  quarter  did 
not  confirm  that  belief .  ” 
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Conmantt  The  next  paragraph,  Completeness  of  Reports,  indicates 
that  the  CIO  staff  was  correct:  the  Components  did  show 
improvement  in  their  submittals.  Those  Components  who  provided 
data  that  was  "incomplete"  did  not  report  embedded  chip 
information.  This  information  is  more  difficult  to  accumulate 
and  verify.  Also,  the  five  DoD  Components  who  did  not  submit  a 
report,  but  requested  that  the  DIST  be  used  to  generate  their 
reports  were  compliant  with  the  DoD  reporting  requirement  in 
making  this  request. 

Pag#  8,  Usefulness  of  Required  Data:  'We  concluded  that  some 

data  that  CIO  required  was  of  little  use  for  oversight  purposes. 
Although  the  primary  concern  of  0MB  personnel  was  mission 
critical  systems,  they  also  required  a  brief  narrative 
summarizing  progress  made  in  other  infrastructure  systems  that 
relied  on  embedded  microchips,  such  as  elevators,  security 
systems,  and  biomedical  devices.  Within  the  infrastructure 
reporting  category,  the  CIO  requires  Components  to  report 
personal  computers,  file  servers,  and  communications  hardware 
and  software  modules." 

Comment  ;  The  DoD  CIO  asked  for  a  one-line  entry  for  each  of 
these  devices  not  associated  with  an  AIS.  All  must  be  checked 
for  Y2K  compliance.  It 'is  part  of  the  oversight  process  to 
accumulate  the  information  that  they  have  been  checked  and  what 
their  Y2K  status  is.  There  is  not  an  inventory  of  the  total 
number  of  DoD  personal  computers  and  network  components  or  of 
the  total  number  of  bio-medical  devices.  The  fact  remains, 
however,  that  this  equipment  must  be  evaluated  for  Y2K 
compliance.  The  Single  Agency  Manager  for  our  organization 
acceptance  tests  each  new  personal  computer  as  it  is  delivered 
and  has  found  that  30%  or  more  of  these  new  deliveries  are  non- 
compliant . 
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Audit  Team  Members 


This  report  was  prepared  by  the  Acquisition  Management  Directorate,  Office  of  the 
Assistant  Inspector  General  for  Auditing,  DoD. 

Thomas  F.  Gimble 
Patricia  A.  Brannin 
Mary  Lu  Ugone 
James  W.  Hutchinson 
Timothy  J.  Harris 
Maria  R.  Palladino 


